Trojan vundo

hatem -  
Problème j'ai un énorme problème avec trojan vundo j'ai tout essayé et rien à faire, les messages d'erreur sont incessants de Norton AntiVirus
Configuration: Windows XP
Firefox 2.0.0.4

6 réponses

  1.  green day Modérateur
    Très bien !

    comment se comporte le pc, reste-t-il encore des messages d'alerte ???

    ++
    1. green day Modérateur
      Salut

      as tu fais le scan avec avg antispy ???

      si oui, poste le rapport stp !

      ++
      1. hatem
        Ma très chère il y a rien à signaler sur le rapport de avg;
        par contre j'ai un autre trojan
        ------------------------------------------------------------------------------------------------------------------------
        AVG Anti - Spywar - Rapport d'analyse
        ------------------------------------------------------------------------------------------------------------------------
        + Crée à : 20:15:57 07/06/2007

        + Résultat de l'analyse:

        Rien à signaler.

        Fin du rapport
    2. green day Modérateur
      oui, c'est pas encore finis :)

      fais ce qui est indiqué ici stp :

      virus methode preliminaire de desinfection version fr

      ++
      1. hatem
        Voilà cher ami après des interminables heures de décontamination, je te remercie encore de ton aide précieuse:

        Pour Bit Defender:

        //-----------------------------------------------------------------
        //
        // Product BitDefender Antivirus v10
        // Product 10.2
        //
        // Created on: 06/06/2007 22:33:03
        //
        //-----------------------------------------------------------------

        Virus Statistics

        Scan path : C:\
        Folders : 6502
        Files : 346738
        Memory processes scanned : 43
        Archives : 10067
        Runtime packers : 25397
        Identified viruses : 13
        Infected files : 23
        Memory processes infected : 1
        Suspect files : 1
        Warnings : 0
        Disinfected files : 0
        Deleted files : 1
        Moved files : 22
        I/O errors : 48
        Scan time : 02:19:41
        Scan speed (files/sec) : 41

        Spyware Statistics

        Registry keys scanned : 1961
        Registry keys infected : 1
        Cookies scanned : 9
        Cookies infected : 0
        Spyware files infected : 0
        Spyware threats detected : 1

        Virus definitions : 560377
        Scan plugins : 16
        Archive plugins : 41
        Unpack plugins : 6
        Mail plugins : 6
        System plugins : 5

        Virus scan options

        Detection
        [X] Scan boot sectors
        [X] Memory Processes
        [X] Scan archives
        [X] Scan runtime packers
        [X] Scan email

        File mask
        [ ] Programs
        [X] All files
        [ ] User defined extensions:
        [ ] Exclude extensions: ;

        Action

        Infected objects
        [ ] Ignore
        [X] Disinfect
        [ ] Delete
        [ ] Move to quarantine
        [ ] Prompt user

        Second action
        [ ] Ignore
        [ ] Delete
        [X] Move to quarantine
        [ ] Prompt user

        Virus scan options
        [X] Enable warnings
        [X] Enable heuristics
        [ ] Show all files in log
        [X] Report file: C:\Documents and Settings\All Users\Application Data\Bitdefender\Desktop\Profiles\Logs\deep_scan\1181161983.log

        Spyware scan options

        [X] Scan for riskware
        [ ] Skip dial and applications from scan
        [X] Registry keys
        [X] Cookies

        Summary:

        <System>=>C:\WINDOWS\system32\CROSOF~1\taskmgr.exe (memory dump) Detected: Adware.Purityscan.BH
        <System>=>C:\WINDOWS\system32\CROSOF~1\taskmgr.exe (memory dump) Disinfection failed
        <System>=>C:\WINDOWS\system32\CROSOF~1\taskmgr.exe (memory dump) Move failed
        <System>=>C:\WINDOWS\system32\CROSOF~1\taskmgr.exe (full dump) Detected: Adware.Purityscan.BH
        <System>=>C:\WINDOWS\system32\CROSOF~1\taskmgr.exe (full dump) Disinfection failed
        <System>=>C:\WINDOWS\system32\CROSOF~1\taskmgr.exe (full dump) Move failed
        <System>=>HKEY_CLASSES_ROOT\CLSID\{763BD795-24AE-44D7-82D8-F9A1EE799729} Detected: WhenU.WhenUSearch
        <System>=>HKEY_CLASSES_ROOT\CLSID\{763BD795-24AE-44D7-82D8-F9A1EE799729} Deleted
        <System> Archive repacking has failed (marked actions not taken)
        C:\Documents and Settings\HaTeM\Mes documents\Mes Docs\Norgine\2_Compta Industr & plan de compte ICA pour JDE\5 Préparation PRI\PRI 2003\Base de travail\extraction centre de charge.xls Suspect: Macro.VBA
        C:\Program Files\Norton AntiVirus\Quarantine\06281D72.dll=>(Quarantine-2) Infected: Trojan.Virtumod.ALZ
        C:\Program Files\Norton AntiVirus\Quarantine\06281D72.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\06281D72.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\0BDA5493.tmp=>(Quarantine-2) Infected: Trojan.Downloader.Agent.BRF
        C:\Program Files\Norton AntiVirus\Quarantine\0BDA5493.tmp=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\0BDA5493.tmp Moved
        C:\Program Files\Norton AntiVirus\Quarantine\121B7E14.exe=>(Quarantine-2) Infected: Trojan.Downloader.LoadAdv.C
        C:\Program Files\Norton AntiVirus\Quarantine\121B7E14.exe=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\121B7E14.exe Moved
        C:\Program Files\Norton AntiVirus\Quarantine\12906592.exe=>(Quarantine-2) Infected: Trojan.Downloader.LoadAdv.C
        C:\Program Files\Norton AntiVirus\Quarantine\12906592.exe=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\12906592.exe Moved
        C:\Program Files\Norton AntiVirus\Quarantine\19A815C4.exe=>(Quarantine-2) Infected: Trojan.Downloader.LoadAdv.C
        C:\Program Files\Norton AntiVirus\Quarantine\19A815C4.exe=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\19A815C4.exe Moved
        C:\Program Files\Norton AntiVirus\Quarantine\27AD60CF.dll=>(Quarantine-2) Infected: Trojan.Vundo.AY
        C:\Program Files\Norton AntiVirus\Quarantine\27AD60CF.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\27AD60CF.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\3DDE7B8D.dll=>(Quarantine-2) Infected: Trojan.Vundo.DLU
        C:\Program Files\Norton AntiVirus\Quarantine\3DDE7B8D.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\3DDE7B8D.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\4C36189B.dll=>(Quarantine-2) Infected: MemScan:Trojan.BHO.BM
        C:\Program Files\Norton AntiVirus\Quarantine\4C36189B.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\4C36189B.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\4EBC11D4.exe=>(Quarantine-2) Infected: Trojan.LowZones.SA
        C:\Program Files\Norton AntiVirus\Quarantine\4EBC11D4.exe=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\4EBC11D4.exe Moved
        C:\Program Files\Norton AntiVirus\Quarantine\5A396CF0.exe=>(Quarantine-2) Infected: Trojan.Downloader.Agent.YCV
        C:\Program Files\Norton AntiVirus\Quarantine\5A396CF0.exe=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\5A396CF0.exe Moved
        C:\Program Files\Norton AntiVirus\Quarantine\70E619B5.dll=>(Quarantine-2) Infected: Trojan.Vundo.DLU
        C:\Program Files\Norton AntiVirus\Quarantine\70E619B5.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\70E619B5.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\71AA70DD.dll=>(Quarantine-2) Infected: Trojan.Vundo.DLU
        C:\Program Files\Norton AntiVirus\Quarantine\71AA70DD.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\71AA70DD.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\71AD1ADA.dll=>(Quarantine-2) Infected: Trojan.Vundo.DLU
        C:\Program Files\Norton AntiVirus\Quarantine\71AD1ADA.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\71AD1ADA.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\7267740D.dll=>(Quarantine-2) Infected: Trojan.Vundo.DLU
        C:\Program Files\Norton AntiVirus\Quarantine\7267740D.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\7267740D.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\72BC6637.exe=>(Quarantine-2) Infected: Trojan.Downloader.Agent.BRF
        C:\Program Files\Norton AntiVirus\Quarantine\72BC6637.exe=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\72BC6637.exe Moved
        C:\Program Files\Norton AntiVirus\Quarantine\751E1197.dll=>(Quarantine-2) Infected: Trojan.Virtumonde.IC
        C:\Program Files\Norton AntiVirus\Quarantine\751E1197.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\751E1197.dll Moved
        C:\Program Files\Norton AntiVirus\Quarantine\76F52F91.exe=>(Quarantine-2) Infected: Trojan.Downloader.Agent.BRF
        C:\Program Files\Norton AntiVirus\Quarantine\76F52F91.exe=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\76F52F91.exe Moved
        C:\Program Files\Norton AntiVirus\Quarantine\7A060314.tmp=>(Quarantine-2) Infected: Trojan.Dialer.VTA
        C:\Program Files\Norton AntiVirus\Quarantine\7A060314.tmp=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\7A060314.tmp Moved
        C:\Program Files\Norton AntiVirus\Quarantine\7F5B44A8.dll=>(Quarantine-2) Infected: Trojan.Vundo.AY
        C:\Program Files\Norton AntiVirus\Quarantine\7F5B44A8.dll=>(Quarantine-2) Disinfection failed
        C:\Program Files\Norton AntiVirus\Quarantine\7F5B44A8.dll Moved
        C:\QooBox\Quarantine\C\Program Files\Fichiers communs\Yazzle1162OinAdmin.exe.vir Detected: Adware.Purityscan.BH
        C:\QooBox\Quarantine\C\Program Files\Fichiers communs\Yazzle1162OinAdmin.exe.vir Disinfection failed
        C:\QooBox\Quarantine\C\Program Files\Fichiers communs\Yazzle1162OinAdmin.exe.vir Moved
        C:\QooBox\Quarantine\C\WINDOWS\system32\CROSOF~1\taskmgr.exe Detected: Adware.Purityscan.BH
        C:\QooBox\Quarantine\C\WINDOWS\system32\CROSOF~1\taskmgr.exe Disinfection failed
        C:\QooBox\Quarantine\C\WINDOWS\system32\CROSOF~1\taskmgr.exe Moved
        C:\WINDOWS\system32\pqa.dll Detected: Adware.PurityScan.AK
        C:\WINDOWS\system32\pqa.dll Disinfection failed
        C:\WINDOWS\system32\pqa.dll Moved

        Pour le rapport Hijack:

        Logfile of HijackThis v1.99.1
        Scan saved at 00:56:51, on 07/06/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16441)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\WINDOWS\system32\spoolsv.exe
        c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\Program Files\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        C:\WINDOWS\ehome\ehtray.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        C:\WINDOWS\system32\TPSMain.exe
        C:\Program Files\Synaptics\SynTP\Toshiba.exe
        C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        C:\WINDOWS\system32\TPSBattM.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
        C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
        C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
        C:\Program Files\DAEMON Tools\daemon.exe
        C:\WINDOWS\eHome\ehmsas.exe
        C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
        C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
        C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
        C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
        C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
        C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
        C:\WINDOWS\system32\CROSOF~1\taskmgr.exe
        C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
        C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
        C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
        C:\WINDOWS\system32\wbem\wmiapsrv.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
        C:\Program Files\MSN Messenger\usnsvc.exe
        C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
        C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
        C:\Program Files\Softwin\BitDefender10\bdagent.exe
        C:\Program Files\Softwin\BitDefender10\bdmcon.exe
        C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
        C:\Program Files\Softwin\BitDefender10\vsserv.exe
        C:\Program Files\Softwin\BitDefender10\bdlite.exe
        C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
        C:\Program Files\Fichiers communs\Ahead\lib\NMIndexStoreSvr.exe
        C:\WINDOWS\explorer.exe
        C:\WINDOWS\notepad.exe
        C:\Program Files\Windows NT\Accessoires\WORDPAD.EXE
        C:\Documents and Settings\HaTeM\Mes documents\Mes Logiciels\HijackThis.exe

        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {90887DEC-A191-4DE8-B564-ED2925B035B2} - (no file)
        O2 - BHO: (no name) - {920D4249-82D6-A85F-887F-8DADDBE122B4} - C:\WINDOWS\system32\pqa.dll (file missing)
        O2 - BHO: CNisExtBho Class - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O2 - BHO: (no name) - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - (no file)
        O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
        O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
        O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {F073BDC9-0D67-4ff0-879E-27241C843828} /MODE CfgWiz /CMDLINE "REBOOT"
        O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
        O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
        O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
        O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
        O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
        O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
        O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
        O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
        O4 - HKLM\..\RunOnce: [getPlusUninstall_dll] rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSd.INF, DefaultUninstall
        O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
        O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
        O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htm
        O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://regulus.upmf-grenoble.fr/qp2.cab
        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
        O20 - Winlogon Notify: urqqnkk - urqqnkk.dll (file missing)
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O20 - Winlogon Notify: wingsa32 - C:\WINDOWS\SYSTEM32\wingsa32.dll
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
        O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
        O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
        O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
        O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
      2. hatem
        @hatemFaut il que je télécharge un nouveau logiciel ?
      3. hatem
        je vais un petit tour j'attens ta réponse avec impatience
    3. green day Modérateur
      ok, on continue :

      Télécharge ComboFix (par sUBs) d'un de ces liens sur ton bureau:

      http://www.techsupportforum.com/sectools/combofix.exe

      http://download.bleepingcomputer.com/sUBs/ComboFix.exe

      Double clique combofix.exe et suis les invites

      Poste le rapport!

      avec un nouveau hijack stp

      ++
      1. hatem
        j'ai une nouvelle infection je fais les scans Trojan.Nebuler je suis en train de faire les scans
      2. hatem
        Pour hijack

        Logfile of HijackThis v1.99.1
        Scan saved at 20:49:51, on 06/06/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16441)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\WINDOWS\system32\spoolsv.exe
        c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\Program Files\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        C:\WINDOWS\ehome\ehtray.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        C:\WINDOWS\system32\TPSMain.exe
        C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
        C:\Program Files\Synaptics\SynTP\Toshiba.exe
        C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        C:\WINDOWS\system32\TPSBattM.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
        C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
        C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
        C:\Program Files\DAEMON Tools\daemon.exe
        C:\WINDOWS\eHome\ehmsas.exe
        C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
        C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
        C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
        C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
        C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
        C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
        C:\WINDOWS\system32\CROSOF~1\taskmgr.exe
        C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
        C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
        C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\WINDOWS\system32\cmd.exe
        C:\Documents and Settings\HaTeM\Application Data\F?nts\n?pdb.exe
        C:\WINDOWS\system32\wbem\wmiapsrv.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Documents and Settings\HaTeM\Mes documents\Mes Logiciels\HijackThis.exe

        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {90887DEC-A191-4DE8-B564-ED2925B035B2} - C:\WINDOWS\system32\ddcyw.dll (file missing)
        O2 - BHO: (no name) - {920D4249-82D6-A85F-887F-8DADDBE122B4} - C:\WINDOWS\system32\pqa.dll
        O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O2 - BHO: (no name) - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - (no file)
        O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
        O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
        O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {F073BDC9-0D67-4ff0-879E-27241C843828} /MODE CfgWiz /CMDLINE "REBOOT"
        O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
        O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
        O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
        O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
        O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
        O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKLM\..\RunOnce: [getPlusUninstall_dll] rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSd.INF, DefaultUninstall
        O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
        O4 - HKCU\..\Run: [Dwte] "C:\WINDOWS\system32\CROSOF~1\taskmgr.exe" -vt yazb
        O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
        O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htm
        O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://regulus.upmf-grenoble.fr/qp2.cab
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
        O20 - Winlogon Notify: urqqnkk - urqqnkk.dll (file missing)
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O20 - Winlogon Notify: wingsa32 - C:\WINDOWS\SYSTEM32\wingsa32.dll
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
        O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

        pour combo c'est :
        "HaTeM" - 2007-06-06 20:45:06 Service Pack 2 NTFS
        ComboFix 07-06-3B - Running from: "C:\Documents and Settings\HaTeM\Bureau\"

        ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

        -- Purity Folders:
        C:\DOCUME~1\HaTeM\APPLIC~1\FNTS~1
        C:\Program Files\Fichiers communs\Yazzle1162OinAdmin.exe
        C:\Program Files\Fichiers communs\Yazzle1162OinUninstaller.exe
        C:\Program Files\outerinfo
        C:\Program Files\outerinfo\Terms.rtf
        C:\WINDOWS\system32\CROSOF~1
        C:\WINDOWS\system32\wnsapiicomsv.exe

        ((((((((((((((((((((((((( Files Created from 2007-05-06 to 2007-06-06 )))))))))))))))))))))))))))))))

        2007-06-06 20:11 <REP> d-------- C:\VundoFix Backups
        2007-05-31 21:47 5,504 --a------ C:\WINDOWS\system32\drivers\MSTEE.sys
        2007-05-31 21:47 15,360 --a------ C:\WINDOWS\system32\drivers\StreamIP.sys
        2007-05-31 21:47 10,880 --a------ C:\WINDOWS\system32\drivers\NdisIP.sys
        2007-05-31 21:46 85,376 --a------ C:\WINDOWS\system32\drivers\NABTSFEC.sys
        2007-05-31 21:46 19,328 --a------ C:\WINDOWS\system32\drivers\WSTCODEC.SYS
        2007-05-31 21:46 17,024 --a------ C:\WINDOWS\system32\drivers\CCDECODE.sys
        2007-05-31 21:46 11,136 --a------ C:\WINDOWS\system32\drivers\SLIP.sys
        2007-05-31 21:45 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
        2007-05-31 21:45 54,784 --a------ C:\WINDOWS\system32\vfwwdm32.dll
        2007-05-31 21:45 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
        2007-05-31 21:36 938,272 --a------ C:\WINDOWS\system32\drivers\LV302V32.SYS
        2007-05-31 21:36 527,136 --a------ C:\WINDOWS\system32\LVUI2RC.dll
        2007-05-31 21:36 41,504 --a------ C:\WINDOWS\system32\drivers\LVUSBSta.sys
        2007-05-31 21:36 348,160 --a------ C:\WINDOWS\system\msvcr71.dll
        2007-05-31 21:36 264,992 --a------ C:\WINDOWS\system32\lvcodec2.dll
        2007-05-31 21:36 215,840 --a------ C:\WINDOWS\system32\LVUI2.dll
        2007-05-31 21:36 14,240 --a------ C:\WINDOWS\system32\drivers\lv302af.sys
        2007-05-31 21:36 13,398 --a------ C:\WINDOWS\system32\Repository.reg
        2007-05-31 21:36 129,824 --a------ C:\WINDOWS\system32\lvci1051.dll
        2007-05-31 21:33 60,928 --a------ C:\WINDOWS\system32\pqa.dll
        2007-05-31 21:33 <REP> d-------- C:\Program Files\Fichiers communs\LogiShrd
        2007-05-31 21:33 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
        2007-05-31 21:33 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logishrd
        2007-05-31 21:32 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\tezchiby.exe
        2007-05-31 21:30 <REP> d-------- C:\Program Files\Logitech
        2007-05-21 00:44 18,944 --------- C:\WINDOWS\system32\wingsa32.dll
        2007-05-21 00:43 <REP> d-------- C:\DOCUME~1\HaTeM\APPLIC~1\AVS4YOU
        2007-05-21 00:42 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
        2007-05-21 00:41 261,632 --a------ C:\WINDOWS\system32\mcdvd_32.dll
        2007-05-21 00:41 24,576 --a------ C:\WINDOWS\system32\msxml3a.dll
        2007-05-21 00:41 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
        2007-05-21 00:41 <REP> d-------- C:\Program Files\Fichiers communs\AVSMedia
        2007-05-21 00:41 <REP> d-------- C:\Program Files\AVS4YOU

        (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

        2007-06-06 16:41:17 1,870 ----a-w C:\WINDOWS\mozver.dat
        2007-06-06 16:17:45 -------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
        2007-06-05 21:37:51 -------- d-----w C:\Program Files\Norton AntiVirus
        2007-05-31 19:42:25 -------- d-----w C:\DOCUME~1\HaTeM\APPLIC~1\AdobeUM
        2007-05-27 00:11:47 -------- d-----w C:\Program Files\eMule
        2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
        2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
        2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
        2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
        2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
        2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
        2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
        2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
        2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
        2007-04-07 08:59:01 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd3517.sys
        2007-04-06 23:09:46 75,704 ----a-w C:\WINDOWS\system32\perfc00C.dat
        2007-04-06 23:09:46 468,728 ----a-w C:\WINDOWS\system32\perfh00C.dat
        2007-03-31 23:14:34 0 ----a-w C:\WINDOWS\nsreg.dat
        2007-03-17 13:44:47 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll
        2007-03-08 15:37:50 578,560 ----a-w C:\WINDOWS\system32\user32.dll
        2007-03-08 15:37:50 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
        2007-03-08 15:37:50 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
        2007-03-08 15:33:58 1,843,712 ----a-w C:\WINDOWS\system32\win32k.sys
        2004-02-22 22:00:00 1,386,496 --sha-r C:\WINDOWS\system32\msvbvm60.dll

        ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

        *Note* empty entries & legit default entries are not shown

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
        {2F85D76C-0569-466F-A488-493E6BD0E955}=C:\Program Files\Windows Desktop Search\dsWebAllow.dll [2006-03-26 22:44]
        {5CA3D70E-1895-11CF-8E15-001234567890}=C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-10-06 05:20]
        {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22]
        {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-07-07 13:29]
        {90887DEC-A191-4DE8-B564-ED2925B035B2}=C:\WINDOWS\system32\ddcyw.dll []
        {920D4249-82D6-A85F-887F-8DADDBE122B4}=C:\WINDOWS\system32\pqa.dll [2007-05-21 15:59]
        {9ECB9560-04F9-4bbc-943D-298DDF1699E1}=C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll [2005-10-22 18:29]
        {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\MSN Toolbar Suite\msntb.dll [2005-11-09 18:52]
        {BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton AntiVirus\NavShExt.dll [2005-11-22 12:04]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "nwiz"="nwiz.exe" [2006-05-01 22:04 C:\WINDOWS\system32\nwiz.exe]
        "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 01:02]
        "RTHDCPL"="RTHDCPL.EXE" [2006-05-05 15:59 C:\WINDOWS\RTHDCPL.exe]
        "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2004-08-18 12:37]
        "AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 16:50 C:\WINDOWS\agrsmmsg.exe]
        "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2006-08-25 13:47]
        "TPSMain"="TPSMain.exe" [2005-08-03 16:09 C:\WINDOWS\system32\TPSMain.exe]
        "NDSTray.exe"="NDSTray.exe" []
        "Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2006-02-02 13:11]
        "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 09:24]
        "TFncKy"="TFncKy.exe" []
        "ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [2005-09-17 00:27]
        "IS CfgWiz"="C:\Program Files\Norton Internet Security\cfgwiz.exe" [2005-09-29 22:33]
        "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-08-02 01:38]
        "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-02 01:32]
        "CFSServ.exe"="CFSServ.exe" []
        "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 16:57]
        "NWEReboot"="" []
        "@"="" []
        "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 18:17]
        "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-04-01 01:27]
        "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-02-08 01:12]
        "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" [2007-02-08 01:13]
        "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
        "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 16:08]
        "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:55]
        "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00]
        "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe" []
        "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe" [2005-09-03 16:18]
        "Tok-Cirrhatus"="" []
        "Dwte"="C:\WINDOWS\system32\CROSOF~1\taskmgr.exe" []

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
        "getPlusUninstall_dll"=rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSd.INF, DefaultUninstall

        [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
        "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
        "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
        "DisableCMD"=0 (0x0)

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
        "{56F9679E-7826-4C84-81F3-532071A8BCC5}"="C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 13:11]
        "{8A61098D-612B-4EF2-943D-64E920684061}"="C:\WINDOWS\system32\mljkjij.dll" []

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqqnkk]
        urqqnkk.dll

        [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wingsa32]
        wingsa32.dll

        HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0a2cb5a2-9086-11db-b57d-00a0d15e0304}]
        AutoRun\command- RavMon.exe

        [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2548673c-c521-11db-b5d0-00a0d15e0304}]
        AutoRun\command- Copie de 1.exe

        *Newly Created Service* - COMHOST

        Contents of the 'Scheduled Tasks' folder
        2007-06-06 18:20:00 C:\WINDOWS\tasks\Check Updates for MSN Search Toolbar.job
        2007-05-18 18:10:21 C:\WINDOWS\tasks\Norton AntiVirus - Analyser mon ordinateur - HaTeM.job

        **************************************************************************

        catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
        Rootkit scan 2007-06-06 20:47:50
        Windows 5.1.2600 Service Pack 2 NTFS

        scanning hidden processes ...

        scanning hidden autostart entries ...

        scanning hidden files ...

        scan completed successfully
        hidden files: 0

        **************************************************************************

        Completion time: 2007-06-06 20:48:32
        C:\ComboFix-quarantined-files.txt ... 2007-06-06 20:48

        --- E O F ---
      3. hatem
        @hatemj'ai l'impression qu'il subsiste des problèmes
    5. green day Modérateur
      Salut

      Téléchargez VundoFix.exe (par Atribune) sur ton Bureau :

      http://www.atribune.org/ccount/click.php?id=4

      *Double-clique VundoFix.exe afin de le lancer.
      * Cliquez sur le bouton Scan for Vundo.
      * Lorsque le scan est complété, cliquez sur le bouton Remove Vundo.
      * Une invite vous demandera supprimer les fichiers, clique YES
      * Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
      * le PC va s'éteindre ("shutdown") : clique OK
      * Démarrez votre PC à nouveau
      * Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

      ++
      1. hatem
        JE SUIS en train de faire les scans et je te donne ça je te remercie
      2. hatem
        @hatemVoici le scan de Hijack

        Logfile of HijackThis v1.99.1
        Scan saved at 20:33:46, on 06/06/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16441)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\WINDOWS\Explorer.EXE
        C:\WINDOWS\system32\spoolsv.exe
        c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\Program Files\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        C:\WINDOWS\ehome\ehtray.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        C:\WINDOWS\system32\TPSMain.exe
        C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
        C:\Program Files\Synaptics\SynTP\Toshiba.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        C:\WINDOWS\system32\TPSBattM.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
        C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
        C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
        C:\Program Files\DAEMON Tools\daemon.exe
        C:\WINDOWS\eHome\ehmsas.exe
        C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
        C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
        C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
        C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
        C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
        C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
        C:\WINDOWS\system32\CROSOF~1\taskmgr.exe
        C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
        C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
        C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
        C:\Documents and Settings\HaTeM\Mes documents\Mes Logiciels\HijackThis.exe

        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {90887DEC-A191-4DE8-B564-ED2925B035B2} - C:\WINDOWS\system32\ddcyw.dll (file missing)
        O2 - BHO: (no name) - {920D4249-82D6-A85F-887F-8DADDBE122B4} - C:\WINDOWS\system32\pqa.dll
        O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
        O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
        O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
        O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
        O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {F073BDC9-0D67-4ff0-879E-27241C843828} /MODE CfgWiz /CMDLINE "REBOOT"
        O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
        O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
        O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
        O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
        O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
        O4 - HKCU\..\Run: [Dwte] "C:\WINDOWS\system32\CROSOF~1\taskmgr.exe" -vt yazb
        O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
        O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htm
        O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://regulus.upmf-grenoble.fr/qp2.cab
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
        O20 - Winlogon Notify: urqqnkk - urqqnkk.dll (file missing)
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O20 - Winlogon Notify: wingsa32 - C:\WINDOWS\SYSTEM32\wingsa32.dll
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
        O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

        et celui de vundofix:

        VundoFix V6.4.2

        Checking Java version...

        Java version is 1.5.0.6
        Old versions of java are exploitable and should be removed.

        Scan started at 20:11:15 06/06/2007

        Listing files found while scanning....

        C:\WINDOWS\system32\ddcyw.dll
        C:\WINDOWS\system32\mljkjij.dll
        C:\WINDOWS\system32\qubshald.dll
        C:\WINDOWS\system32\uflgcnhx.dll
        C:\WINDOWS\system32\urqqnkk.dll
        C:\WINDOWS\system32\wycdd.bak1
        C:\WINDOWS\system32\wycdd.bak2
        C:\WINDOWS\system32\wycdd.ini
        C:\WINDOWS\system32\xxyywwx.dll

        Beginning removal...

        Attempting to delete C:\WINDOWS\system32\ddcyw.dll
        C:\WINDOWS\system32\ddcyw.dll Could not be deleted.

        Attempting to delete C:\WINDOWS\system32\mljkjij.dll
        C:\WINDOWS\system32\mljkjij.dll Could not be deleted.

        Attempting to delete C:\WINDOWS\system32\wycdd.bak1
        C:\WINDOWS\system32\wycdd.bak1 Has been deleted!

        Attempting to delete C:\WINDOWS\system32\wycdd.bak2
        C:\WINDOWS\system32\wycdd.bak2 Has been deleted!

        Attempting to delete C:\WINDOWS\system32\wycdd.ini
        C:\WINDOWS\system32\wycdd.ini Has been deleted!

        Attempting to delete C:\WINDOWS\system32\xxyywwx.dll
        C:\WINDOWS\system32\xxyywwx.dll Has been deleted!

        Performing Repairs to the registry.
        Done!

        Beginning removal...

        Attempting to delete C:\WINDOWS\system32\ddcyw.dll
        C:\WINDOWS\system32\ddcyw.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\mljkjij.dll
        C:\WINDOWS\system32\mljkjij.dll Has been deleted!

        Performing Repairs to the registry.
        Done!

        Voilà à vous de jouer et merci encore
    6. hatem
      S'il vous plait aidez moi....
      1. hatem
        Voilà mon log Hi jack

        Logfile of HijackThis v1.99.1
        Scan saved at 19:26:57, on 06/06/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16441)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        C:\WINDOWS\system32\spoolsv.exe
        c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\WINDOWS\eHome\ehRecvr.exe
        C:\WINDOWS\eHome\ehSched.exe
        C:\Program Files\Norton AntiVirus\navapsvc.exe
        C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        C:\WINDOWS\ehome\ehtray.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        C:\Program Files\Synaptics\SynTP\Toshiba.exe
        C:\WINDOWS\RTHDCPL.EXE
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
        C:\WINDOWS\system32\TPSMain.exe
        C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
        C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        C:\Program Files\TOSHIBA\Commandes TOSHIBA\TFncKy.exe
        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe
        C:\WINDOWS\system32\TPSBattM.exe
        C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
        C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
        C:\Program Files\DAEMON Tools\daemon.exe
        C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
        C:\WINDOWS\eHome\ehmsas.exe
        C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
        C:\WINDOWS\system32\dllhost.exe
        C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
        C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
        C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
        C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        C:\Program Files\MSN Messenger\MsnMsgr.Exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe
        C:\Program Files\Fichiers communs\LogiShrd\LComMgr\LVComSX.exe
        C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
        C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
        C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
        C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Program Files\MSN Messenger\usnsvc.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Program Files\Messenger\msmsgs.exe
        C:\Documents and Settings\HaTeM\Mes documents\Mes Logiciels\HijackThis.exe

        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O2 - BHO: (no name) - {90887DEC-A191-4DE8-B564-ED2925B035B2} - C:\WINDOWS\system32\ddcyw.dll
        O2 - BHO: (no name) - {920D4249-82D6-A85F-887F-8DADDBE122B4} - C:\WINDOWS\system32\pqa.dll
        O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O2 - BHO: Barre d'outils MSN Search Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O2 - BHO: (no name) - {CACA7731-9C77-464A-B1B7-462281DD8164} - C:\WINDOWS\system32\urqqnkk.dll (file missing)
        O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINDOWS\system32\uflgcnhx.dll (file missing)
        O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll
        O3 - Toolbar: Barre d'outils MSN Search - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dll
        O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
        O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
        O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
        O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
        O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
        O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
        O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
        O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
        O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
        O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
        O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {F073BDC9-0D67-4ff0-879E-27241C843828} /MODE CfgWiz /CMDLINE "REBOOT"
        O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
        O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
        O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
        O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
        O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
        O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
        O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
        O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
        O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
        O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
        O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\lib\NMBgMonitor.exe"
        O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
        O8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htm
        O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://regulus.upmf-grenoble.fr/qp2.cab
        O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
        O20 - Winlogon Notify: ddcyw - C:\WINDOWS\system32\ddcyw.dll
        O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
        O20 - Winlogon Notify: urqqnkk - urqqnkk.dll (file missing)
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O20 - Winlogon Notify: wingsa32 - C:\WINDOWS\SYSTEM32\wingsa32.dll
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
        O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe
        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
        O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
        O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
        O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
        O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
        O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
        O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
        O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
        O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\FICHIE~1\SYMANT~1\SCRIPT~1\SBServ.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe
        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe
        O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe
        O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

    Discussions similaires

    Aide pour un virus
    cerise92700

    41 réponses
    Trojan impossible à supprimer!
    Gridouu

    12 réponses
    Comment supprimer le virus Trojan
    vitsou

    18 réponses
    Cheval de Troie- e.tre456.worm.windows
    Ninou037

    13 réponses
    trojan-spy.win32@mx
    caramel79

    3 réponses